Ms. P, 45, was a nurse working in the cardiology department of a large hospital. Her duties were varied, and included, among other things, accessing patient medical records to review lab values and other diagnostic tests ordered by physicians, and writing progress notes in patients’ charts.
When she was originally hired by the hospital, she was given a lecture from human resources about the importance of patient confidentiality. Ms. P was required to sign an agreement stating that she would protect patient confidentiality by only seeking or obtaining information regarding a patient that was required to perform her duties.
Later, when the U.S. Health Insurance Portability and Accountability Act (HIPAA) went into effect, Ms. P was required to go to another human resources seminar and sign a revised confidentiality agreement.
Continue Reading
The revised agreement stated that she would not access or view information other than what was required to do her job, and that she would immediately ask her supervisor for clarification if she had any questions about whether information was required for her job.
Finally, the agreement contained a section saying that Ms. P acknowledged that violation of the facility’s confidentially policy could result in disciplinary action up to and including termination.
Ms. P understood the importance of patient confidentiality and would never look in the records of patients that weren’t hers—with two exceptions. Ms. P’s mother and sister both had serious chronic conditions that frequently resulted in hospital visits over the years.
Ms. P’s mother had Parkinson’s disease, was on numerous medications, and was prone to falls. Ms. P’s older sister, who lived with her, had Down syndrome. Ms. P would periodically look up her mother’s and sister’s health records on the hospital computer to get information or to access their treatment plans. She didn’t see anything wrong with this because it was her own family.
One of her colleagues, however, had noticed Ms. P looking at the records on more than one occasion, and anonymously reported her. The hospital’s HIPAA compliance officer began an investigation that revealed that Ms. P had accessed her mother’s charts on 44 separate occasions and her sister’s charts on 28 occasions.
When the human resources director confronted her with the results of the investigation, Ms. P admitted that she had accessed the records, but that they were the records of her family members and therefore she didn’t see anything wrong with it.
“Did you need to access information from their medical records in order to do your job as a clinical affiliate in the cardiology department?” the human resources director asked sternly.
“No,” Ms. P replied. “They were not cardiology patients.”
She was fired that day. Angered by the loss of her job, Ms. P sought the advice of an attorney to see if she could sue the hospital for wrongful termination. The attorney was skeptical.
“HIPAA violations are taken very seriously,” he said. “Did they give you training about patient privacy?”
Ms. P admitted that she’d had training.
“Were you asked to sign anything?” the attorney inquired.
“Well, yes,” Ms. P said. “I did sign a confidentiality agreement, and the hospital does have a policy that you could lose your job for violating it. But this was my mother and sister! They don’t mind that I looked at their records!”
“That’s irrelevant,” the attorney said. “It doesn’t matter if they are family or not. You still didn’t have the right to look at the records. I don’t think we have a leg to stand on, unless…” the attorney trailed off, thinking.
“How old are you?” he suddenly asked.
When she told him, he smiled. “I think we may have an angle. We can try suing the hospital for age discrimination. We can claim that the privacy violation was merely a pretext to get rid of you – a higher paid experienced nurse – and replace you with a less expensive junior person.”
The attorney filed the papers against the hospital. The hospital’s attorney promptly filed a motion to dismiss. The court, after reviewing all the facts, dismissed Ms. P’s case.
